Loading story…
Proofpoint identified an active Microsoft 365 password-spraying campaign, tracked as UNK_CondorFiltration, that used artifacts linked to the TeamFiltration offensive framework. From July 21 to August 16, the operator generated 32,825 authentication attempts against 5,714 accounts in 28 tenants—primarily Chilean retail and financial organizations—from 1,487 AWS EC2 IP addresses. Seven accounts at a major Chilean retailer were compromised; each was an unmanaged functional or service account with a default, predictable, or unrotated password and no MFA.
After gaining access, the actor used a German VPN node to probe the victim's corporate VPN and access Azure Portal, OfficeHome, and SharePoint Online, while also requesting Microsoft Graph API tokens. Activity could support reconnaissance or collection from email, Teams, OneDrive, and SharePoint, but available sign-in telemetry does not confirm data exfiltration. Organizations should inventory dormant and non-human Microsoft 365 accounts, rotate credentials, eliminate default passwords, and enforce MFA or equivalent controls for service identities.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Within roughly 90 seconds of one compromise, the operator used German VPN IP address 149.88.104.19 to probe the victim's corporate VPN, access Azure Portal, OfficeHome, and SharePoint Online, and request tokens usable with Microsoft Graph or external APIs. MFA or conditional-access controls blocked the corporate-VPN attempt, while Azure Portal prompted for MFA enrollment on the compromised account.
During a third wave against a major Chilean retailer, UNK_CondorFiltration compromised seven unmanaged functional or service accounts that lacked MFA and apparently retained default or predictable passwords. Six accounts were compromised within seven minutes; the retailer accounted for 3,038 targeted accounts and 25,715 authentication events.
A second campaign wave targeted another major Chilean financial institution, peaking at about 1,520 targeted accounts on July 27. The operator made 1,536 authentication attempts against approximately 114 accounts, including 782 attempts against 57 senior accounts.
The first observed wave of the UNK_CondorFiltration Microsoft 365 password-spraying campaign targeted roughly 100 to 120 accounts per day at two major Chilean banking institutions, using AWS EC2 infrastructure.
Proofpoint previously reported that the TeamFiltration-related UNK_SneakyStrike cluster targeted more than 80,000 accounts across hundreds of organizations' cloud tenants using the open-source framework.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Password spraying has remained a persistent intrusion technique against cloud identity platforms, with CISA warning that attackers commonly target **single sign-on**, federated authentication, and email services by trying a small set of weak passwords across many accounts to avoid lockouts. U.S. authorities linked some activity to Iranian actors tied to the Mabna Institute, while Microsoft later reported that Iran-linked **DEV-0343** sprayed passwords across more than 250 Office 365 tenants, focusing on defense, GIS, maritime, and cargo organizations; fewer than 20 tenants were compromised, and accounts protected by **multifactor authentication** were largely resistant. More recent reporting shows the tactic evolving at scale. SecurityScorecard described a botnet of more than **130,000** compromised devices conducting password spraying against **Microsoft 365** by abusing **Basic Authentication** in non-interactive sign-ins, using credentials from infostealer logs and infrastructure tentatively linked to a likely Chinese-affiliated group. Detection content from Splunk also highlighted **Okta ThreatInsight** alerts for suspected password-spray activity, underscoring that identity providers continue to surface this behavior in telemetry. Across the reporting, defenders are urged to enforce MFA, disable legacy and Basic Authentication where possible, strengthen password policies, and monitor sign-in logs for repeated failures, unusual user agents, and distributed login attempts from many IP addresses.
Aug 15, 2026
An Iran-linked threat actor conducted a password-spraying campaign against Microsoft 365 tenants, hitting more than 300 organizations in Israel and over 25 in the United Arab Emirates, with additional targeting in Europe, the United States, the United Kingdom, and Saudi Arabia. Check Point said the activity unfolded in three waves on March 3, 13, and 23 and primarily targeted municipalities, government bodies, energy and transportation organizations, technology firms, and other private-sector cloud environments. The attackers relied on weak passwords and exposed cloud accounts rather than malware or software exploits, using rotating Tor exit nodes and a spoofed Internet Explorer 10 on Windows 7 user agent during reconnaissance before shifting successful logins to commercial VPN infrastructure, including services associated with Windscribe and NordVPN, geolocated in Israel. Researchers said the intrusions led to access to email, documents, administrative tools, and in some cases mailbox data exfiltration. Check Point assessed the activity with moderate confidence as Iran-linked and noted similarities to **Gray Sandstorm**, while also tying parts of the infrastructure to `AS35758`, which has been associated with recent Iran-nexus operations. Israeli municipalities were identified as a primary focus, and the campaign may have supported broader operational objectives such as damage assessment tied to regional military activity. Defenders were urged to review sign-in logs for distributed authentication failures, enforce tenant-wide MFA, strengthen password policies, apply location-based access controls, block Tor where feasible, and retain audit logs for investigation.
Jun 29, 2026
Huntress reported a large password-spraying campaign targeting Microsoft Azure CLI by abusing the deprecated OAuth Resource Owner Password Credentials (ROPC) grant. During a two-week period in mid-June, the company observed more than **81 million** login attempts and **78** account compromises tied to traffic from an IPv6 range associated with hosting provider **LSHIY LLC**. When valid credentials were found, the attackers used a tenant’s `/token` endpoint to obtain user-delegated tokens, allowing access without triggering protections that organizations expected from multi-factor authentication and some Conditional Access configurations. The activity appeared opportunistic rather than focused on a specific sector, and Huntress said many affected organizations either lacked MFA or had Conditional Access policies scoped in ways that left some users exposed. After Huntress notified LSHIY, the provider said abuse of its bring-your-own-IP service had been terminated, but the actor later appeared to move to infrastructure linked to **FranTech** and **Tor** exit nodes. Huntress urged defenders to disable ROPC where possible, restrict Azure CLI use for non-admin users, enforce MFA and Conditional Access across all users and apps, and prioritize incident response based on whether sprayed credentials were valid rather than on spray volume alone.
Jul 30, 2026